Virtual
$15,000
The full day, delivered over video conference.
- Healthcare ransomware tabletop
- The malicious mindset session, live with Q&A
- Prioritized action plan
- All three written deliverables
The flagship · One structured day
The Malicious Mindset Workshop.
A full day with your security team: a healthcare ransomware tabletop, the malicious mindset session taught live with heavy Q&A, and a prioritized action plan ranked by attacker impact. No lab setup, no network access, no pre-engagement prep.
Educational training and consulting.
The day
Four parts, each building on the last.
Your tools in use, your team in place, and a working operator in the room.
01
Context
The malicious mindset framework. Why the attacker’s vantage point is structurally superior to the defender’s, applied to the kind of infrastructure your team protects. By the first exercise, your team understands the asymmetry that makes the rest of the day matter.
02
Tabletop exercise
A realistic ransomware attack chain built for healthcare, from initial access through encryption. Your team works it in real time: what do they notice, what do they respond to, where do their assumptions break down?
03
The malicious mindset session
The intellectual core. How adversaries think about persistence, living-off-the-land tradecraft, blending into legitimate traffic, and staying aware of what defenders are actioning. Heavy Q&A, applied to your specific tooling.
04
The action plan
A prioritized set of focus areas ranked by attacker impact, showing where an adversary would look first in an environment like yours, and which gaps matter most. Your team leaves knowing where to aim the expertise they already have.
You leave with three written deliverables
Attacker Playbook
How adversaries think and move through environments like yours.
Tooling Recommendations
Product guidance with attacker-perspective rationale. What to buy, what to skip, and what to fix first.
Board-Ready Kit
Executive language and ROI framing. The documentation that gets gaps funded.
Pricing
Choose your format.
A flat rate for the day, with add-ons to expand it or options to scale it down.
On-site
$20,000
The full day, in your building.
- Everything in the virtual format
- Physical environment observation
- Extended whiteboarding, far more interactive
- Informal access to the operator all day
- Executive / board readout included
Shape the day
Additional seats · tooling deep-dive · 30-day follow-up call · executive readout for virtual engagements. Add-ons are priced on scope and quoted before you commit.
Only need part of the day? The menu flexes down as well as up; say so in the request and the quote will reflect it.
The guarantee
Actionable findings, or we come back free.
If your team doesn’t leave the Workshop with actionable findings and new confidence recognizing adversary activity, the founder returns for a second day at no charge to close the gap. Still not satisfied? Full refund. You keep every written deliverable either way.
Built to be repeated upstairs in one sentence: findings and confidence, or it costs nothing.
Questions
What security leaders ask us.
We already run penetration tests. Why this?
A penetration test finds your network vulnerabilities. The Malicious Mindset Workshop answers a different question: would your team recognize someone actively exploiting them, and act in time? Both matter, but most hospitals only ever measure the first. Teams that do both find the Workshop changes how their analysts interpret pentest findings.
Do you need access to our network?
No. The Workshop is advisory and educational: no live exploitation, no access to your production network, no access to patient data. If it helps, you can share architecture diagrams or network maps so the day speaks to your environment, and those are kept free of PHI, so no protected health information ever changes hands. Because of that, the engagement doesn’t require a HIPAA business associate agreement, which makes vendor review unusually fast. A scoped SOW arrives with booking confirmation and can state the no-PHI condition in writing, and if your compliance office wants additional paperwork, we’ll work through it.
How do I get this approved?
The Board-Ready Kit is included in the base price for exactly this reason: board-ready language, ROI framing against the cost of a healthcare ransomware event, and approval materials that work whether you’re the champion taking this upstairs or the CISO taking it to the board. A twenty-minute call with the founder and your leadership is also available at no charge if that would accelerate the conversation. Documented gaps are how security leaders win budget, and the engagement is built to produce that evidence.
What exactly does the price depend on?
Format and scope. Virtual ($15,000) and on-site ($20,000) are the two anchors, and the quote moves from there with team size, a tooling deep-dive, a 30-day follow-up call, or an executive readout for virtual engagements. If you only want part of the day, the tabletop or the mindset session on its own, the menu flexes down too. You’ll have a written quote before any commitment.
Who should attend?
The core security team: SOC analysts, security managers, and IT staff with detection and response responsibility. The champion (security director or manager) should be present for the full day. For on-site engagements, the executive readout at day’s end is designed for leadership who can’t attend the full session.
What if it doesn’t produce what you promised?
The Actionable Findings Guarantee covers this explicitly. If your team doesn’t leave with actionable findings and new confidence recognizing adversary activity, the founder returns for a second day at no charge. Still not satisfied after that second day? Full refund. You keep all written deliverables either way.
Get in touch
Twenty minutes. No slide deck. Bring your hardest questions.
A short call about where your team is today, what they’re working with, and whether the Workshop is the right fit. Adversant runs a small number of engagements each quarter by design, so dates are limited.
Book the call →
Prefer email? contact@adversantsecurity.com